Hi,
You can start by using Splunk Security Essentials and InfoSec app for the beginning. If you are an enterprise and have a SOC team, Splunk Enterprise Security ( https://splunkbase.splunk.com/app/263) is the best.
If this reply helps you an upvote and "Accept as Solution" is appreciated.
